CiscoProfessional level300-215Page 3 of 3

300-215 exam dumps: questions 201 to 228 of 228

Page 3 of the free 300-215 question bank for the Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity exam. Questions 201 to 228 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 201 to 228

Free 300-215 practice questions

Questions 201 to 205 of 228

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

300-215 Question 201

Select 3

During an incident response process, your team detects abnormal outbound traffic from a corporate system to an external IP address. You suspect this is a Command and Control (C2) communication. Using Cisco Secure Firewall and Secure Network Analytics, what should you do next to isolate the system while maintaining forensic integrity?

A
Use Cisco Secure Firewall to block all outbound traffic from the suspected system.
B
Leverage Cisco Secure Network Analytics to analyze historical traffic from the suspected system.
C
Immediately shut down the suspected system to stop further data exfiltration.
D
Use Cisco Secure Firewall to enforce a policy that allows only essential internal traffic for the suspected system.
E
Quarantine the system on a separate VLAN using Cisco Secure Firewall features.

Show answer and explanation

Correct answers: B, D, E

Explanation

The correct steps in an incident response process involve isolating the suspected system to prevent further damage while preserving forensic evidence for investigation. Using Cisco Secure Firewall to enforce restrictive but operational policies and leveraging Cisco Secure Network Analytics for traffic analysis are essential actions. Shutting down the system prematurely or blocking all traffic can compromise evidence and investigation efforts.

A. Incorrect.
Blocking all outbound traffic is a reactive measure that does not allow for continued monitoring or controlled isolation, which could hinder forensic investigation.
B. Correct.
Analyzing historical traffic using Cisco Secure Network Analytics helps identify the scope of the incident and other potentially compromised systems.
C. Incorrect.
Shutting down the system immediately could destroy volatile memory data, which is critical for forensic analysis.
D. Correct.
Enforcing a policy to allow only essential internal traffic ensures the system remains operational for investigation while limiting the attacker's actions.
E. Correct.
Quarantining the system on a separate VLAN isolates it effectively while maintaining forensic integrity and allowing controlled access for analysis.

300-215 Question 202

Select 2

A security operations team is alerted to a potential ransomware infection on an employee's workstation. The team initiates the organization's incident response plan and begins containment procedures. Which of the following actions should the team perform as part of the containment phase?

A
Disconnect the affected system from the network to prevent further spread.
B
Shut down the affected system immediately to stop the ransomware process.
C
Capture a memory dump for forensic analysis before taking further action.
D
Apply patches to all systems in the network to close potential vulnerabilities.
E
Redirect the affected system's traffic to a sinkhole for monitoring.

Show answer and explanation

Correct answers: A, C

Explanation

The containment phase of incident response involves isolating the affected system to prevent further damage and collecting critical forensic evidence for analysis. Disconnecting the system and capturing a memory dump are appropriate actions to achieve these goals, while shutting down the system or redirecting traffic may hinder the investigation process or be irrelevant for ransomware cases.

A. Correct.
Disconnecting the affected system from the network is a critical containment step to prevent the ransomware from spreading to other devices.
B. Incorrect.
Shutting down the system immediately is not recommended as it may destroy volatile data, such as memory artifacts, that could be useful for forensic analysis.
C. Correct.
Capturing a memory dump allows the team to preserve volatile data, such as processes and encryption keys, which may be important for investigation and response.
D. Incorrect.
Applying patches is a proactive step but not directly part of the immediate containment phase, which focuses on isolating and limiting the impact of the incident.
E. Incorrect.
Redirecting the affected system's traffic to a sinkhole is more appropriate for specific types of threats (e.g., botnets) but is not typically used for ransomware containment.

300-215 Question 203

Single answer

A security analyst is responding to a ransomware incident in a corporate network. During the incident, the analyst decides to isolate affected systems from the network to prevent further spread of the ransomware. Which step of the incident response process is the analyst performing?

A
Identification
B
Containment
C
Eradication
D
Recovery

Show answer and explanation

Correct answer: B

Explanation

The containment phase of the incident response process is critical for limiting the impact of a security incident. In this scenario, isolating affected systems from the network helps prevent further spread of the ransomware, which is a typical containment activity.

A. Incorrect.
Identification involves detecting and confirming the occurrence of a security incident. While the analyst is aware of the ransomware, the step described is about taking action, not identifying the incident.
B. Correct.
Containment focuses on limiting the spread and impact of an incident. The analyst's decision to isolate affected systems from the network is clearly an action that falls under containment.
C. Incorrect.
Eradication involves removing the root cause or malicious elements of the incident, such as deleting malware or closing vulnerabilities. The scenario does not describe removing the ransomware, only isolating the affected systems.
D. Incorrect.
Recovery involves restoring normal operations and ensuring systems are no longer vulnerable. The analyst’s action in this scenario does not involve restoring systems but rather preventing further damage.

300-215 Question 204

Select 4

During a cybersecurity incident, a Cisco SOC analyst is tasked with responding to a ransomware attack targeting an organization's critical systems. Which of the following accurately describe the primary goals of the incident response process in this scenario?

A
Minimize the impact of the attack on business operations
B
Identify and isolate the affected systems to prevent further spread
C
Immediately restore all affected systems to their pre-attack state without detailed analysis
D
Gather evidence to support legal or regulatory requirements
E
Eradicate the malicious threat and recover the environment

Show answer and explanation

Correct answers: A, B, D, E

Explanation

The primary goals of incident response include minimizing impact, containing the threat, gathering evidence, eradicating the malicious activity, and recovering the environment. These steps ensure the organization can effectively manage the incident, reduce harm, and comply with legal or regulatory obligations. However, immediately restoring systems without proper analysis is counterproductive, as it risks the integrity of forensic evidence and might allow the threat to persist.

A. Correct.
Minimizing the impact on business operations is a critical goal of incident response as it ensures the organization can maintain continuity and reduce potential losses.
B. Correct.
Identifying and isolating affected systems helps contain the threat and prevents the attack from spreading to other systems, which is a key step in the incident response process.
C. Incorrect.
Immediately restoring affected systems without detailed analysis is not a recommended practice because it risks overlooking critical forensic evidence and may allow the threat to persist.
D. Correct.
Gathering evidence during an incident is crucial for supporting legal or regulatory requirements, as well as for post-incident analysis and accountability.
E. Correct.
Eradicating the threat and recovering the environment ensure that the malicious activity is removed and the systems are restored to a secure state, aligning with the goals of incident response.

300-215 Question 205

Select 3

During a security incident involving unauthorized access to a corporate database, your team's response is guided by the typical goals of incident response. Which of the following actions align with these goals?

A
Identify the origin and scope of the breach to contain the threat.
B
Implement a complete system redesign without analyzing the incident.
C
Preserve evidence to support legal or forensic investigations later.
D
Communicate details of the incident to appropriate stakeholders.
E
Ignore the incident if it does not appear to impact core business operations.

Show answer and explanation

Correct answers: A, C, D

Explanation

The goals of incident response include identifying and containing the threat, preserving evidence for forensic and legal purposes, and ensuring effective communication with stakeholders. These actions minimize damage, maintain organizational integrity, and prevent similar incidents in the future. Ignoring incidents or skipping analysis undermines these objectives.

A. Correct.
Correct: Identifying the origin and scope is a foundational goal of incident response as it helps contain the threat and prevent further damage.
B. Incorrect.
Incorrect: Implementing a system redesign without analyzing the incident skips critical steps like containment, investigation, and recovery, which are core to incident response.
C. Correct.
Correct: Preserving evidence is crucial for forensic analysis and legal actions, ensuring that the root cause can be addressed and compliance requirements are met.
D. Correct.
Correct: Communicating with stakeholders ensures transparency, aligns the response team with organizational priorities, and helps manage potential reputation risks.
E. Incorrect.
Incorrect: Ignoring the incident, even if the impact isn't immediately apparent, contradicts the goals of incident response, which prioritize containment, analysis, and prevention of future incidents.

Timed practice exam

Take a 300-215 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

300-215 practice questions 201 to 228 of 228

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.